The wpDiscuz plugin contains an IP spoofing vulnerability in its getIP() function. The function trusts the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers for determining the visitor's IP address without proper validation. An attacker can set these headers to a value that does not match the true client IP, thereby forging the originating address. The vulnerability allows the attacker to bypass IP-based rate limiting and ban enforcement that relies on the reported IP, potentially leading to spamming, brute‑force attacks, or denial of service through repeated actions by a spoofed IP.

This issue affects the wpDiscuz plugin for WordPress made by gVectors. All versions of wpDiscuz prior to 7.6.47 are vulnerable. Installing version 7.6.47 or later removes the vulnerability.

The CVSS base score is 6.9, indicating medium severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring only the ability to send HTTP requests with custom headers to the target WordPress site. Because the exploitation only needs header manipulation, an attacker can perform it from anywhere without additional credentials.